Even if the notification came from Dropbox, don't view or download a file, or accept a shared folder invitation, unless you know the sender. If you don't know the sender, ignore the notification, delete the email, or decline the invitation.